Model-based design is a common methodology in the development of embedded complex control systems. Control system engineers typically prefer to use MATLAB® Simulink® and suitable automatic code generators for the development and deployment of software. Embedded systems are subject to random hardware faults; bit-flips, for example, may affect random access memory (RAM) cells and central processing unit (CPU) registers and cause data errors that may propagate to critical system outputs and result in system failures. From a dependability perspective, the design space of control systems includes the selection of a suitable (reliable) implementation of a control algorithm. Such algorithm can be implemented with model-based software development frameworks, such as Simulink using different, but functionally equivalent implementations. However, these functional equivalents may exhibit completely different reliability properties. This thesis proposes an analytical method for the evaluation of the reliability properties of control systems that are designed with Simulink models. The method is based on a transformation of the assembly code, which is generated from the Simulink model, into a formal stochastic error propagation model as well as its quantification through underlying Markov chain models and state-of-the-art probabilistic model-checking techniques. The application of the method to the functionally equivalent implementations can determine which one is less vulnerable to data errors due to random hardware faults. Fault tolerance is significant to dependable system design. Control systems can be protected with fault tolerance mechanisms to increase the reliability. Redundancy is the key underlying concept for achieving fault tolerance that is usually implemented at the hardware or software level. In the case of model-based development, redundancy mechanisms are preferable for direct application at the model level (Simulink model level). This thesis introduces a systematic classification of fault-tolerant design patterns. Such patterns can be applied to the Simulink model to tolerate random hardware faults, and taken into account during the control system design. In addition, it is more transparent and convenient for control system engineers to directly protect vulnerable parts with fault tolerance mechanisms at the model level. The rigorous reliability assessment of the embedded control systems must be conducted at the assembly level based on the modeling of data errors that occurred in RAM and CPU. However, the scalability of the assembly-level assessment method is challenging and even problematic in view of the state space explosion (SSE) problem of the underlying Markov chain models. The computational complexity may increase exponentially as the assembly code size increases. Moreover, the transformation from the Simulink models to the assembly code is a complicated procedure. It is also more convenient for control engineers to already be able to estimate reliability properties and implement possible reliability improvements at the model level in the early design phase, when the model-based design is actually applied. Therefore, this thesis proposes a model-level reliability evaluation of Simulink models to address the aforementioned problems. The efficiency of the proposed modellevel evaluation is verified by a comparison of the reliability properties that are assessed at the assembly and model levels.:1. Introduction 2. Preliminaries 3. Reliability evaluation of control algorithm implementations at the assembly level 4. Fault-tolerant design patterns 5. MORE: MOdel-based REdundancy for Simulink models 6. Model-level assessment of Simulink models 7. Conclusion

La complexité croissante des applications embarquées dans les voitures modernes augmente le besoin de puissance de calcul. Pour répondre à ce besoin, le standard automobile AUTOSAR introduit l'utilisation de plates-formes multi-cœurs. Cependant, l'utilisation du multi-cœurs pour des applications temps-réel critique automobile soulève plusieurs problématiques. Notamment, il faut respecter la spécification fonctionnelle et garantir de manière déterministe les échanges de données entre cœurs. Dans cette thèse, nous considérons des systèmes multi-périodiques spécifiés et validés fonctionnellement avec des modèles Matlab/Simulink. Ainsi, nous avons développé un framework pour déployer des applications Matlab/Simulink sur AUTOSAR multi-cœurs afin de garantir le déterminisme fonctionnel et temporel tout en exploitant au mieux le parallélisme. Notre contribution a porté sur trois axes. Premièrement nous avons identifié les mécanismes d'échanges de données imposés dans le modèle fonctionnel Matlab/Simulink. Nous avons montré que ces mécanismes pouvaient s'exprimer en utilisant le formalisme des Synchronous Dataflow Graph (SDFG). Ce modèle est un excellent outil d'analyse pour exploiter le parallélisme car il est très populaire dans la littérature et largement étudié pour le déploiement d'applications flow de données sur plateforme multi/many-cœurs. Par la suite, nous avons développé des méthodes pour réaliser le flux de données exprimés par le SDFG dans un ordonnancement temps-réel préemptif. Ces méthodes utilisent des résultats théoriques sur les SDFGs pour garantir les contraintes de précédence de manière déterministe sans utiliser des mécanismes de synchronisation bloquants. De cette sorte, nous garantissons à la fois le déterminisme fonctionnel et temporel des applications. Finalement, nous caractérisons l'impact des contraintes de flux de données sur l'ordonnancement des tâches. Nous proposons une technique de partitionnement qui minimise cet impact. Nous montrons alors que cette technique favorise la construction d'un partitionnement et d'un ordonnancement lorsqu'elle est utilisée pour initialiser des algorithmes de recherche et d'optimisation heuristiques. / The increasing complexity of embedded applications in modern cars has increased the need of computing power. To meet this need, the European automotive standard AUTOSAR has introduced the use of \multicore platforms. However, \multicore platform for critical automotive applications raises several issues. In particular, it is necessary to respect the functional specification and to guarantee deterministically the data exchanges between cores. In this thesis, we consider multi-periodic systems specified and validated with \mat. So, we developed a framework to deploy \mat applications on AUTOSAR \multicore. This framework guarantees the functional and temporal determinism and exploits the parallelism. Our contribution is threefold. First, we identify the communication mechanisms in \mat. Then, we prove that the dataflow in a multi-periodic \mat system is modeled by a SDFG. The SDFG formalism is an excellent analysis tool to exploit the parallelism. In fact, it is very popular in the literature and it is widely studied for the deployment of dataflow applications on multi/many-core. Then, we develop methods to realize the dataflow expressed by the SDFG in a preemptive \rt scheduling. These methods use theoretical results on SDFGs to guarantee deterministic precedence constraints without using blocking synchronization mechanisms. As such, both the functional and temporal determinism are guaranteed. Finally, we characterize the impact of dataflow requirements on tasks. We propose a partitioning technique that minimizes this impact. We show that this technique promotes the construction of a partitioning and a feasible scheduling when it is used to initiate multi-objective research and optimization algorithms. %As such, we reduce the number of design iterations and shorten the design time.

The presented work deals with doctoral thesis named “Electrical drives for critical application”, which is solved in the Institute of Production Machines, Systems and Robotics. The paper tries to subsequently describe the progress during development of electric drive and to introduce the findings reached during project solving. The critical application requirements have been defined at the beginning, especially for the aerospace industry point of view. The work deals with the architecture of the control and power electronic, control software algorithms of the brush and brush-less BLDC motor with respect to the final certification aspects. It is also discussed the effectivness of the new development methods based on the modeling and simulation. The Model Based Design approach have been proved and verified during aircraft onboard equipment development. The findings of these are discussed at the end of this work.

Conventional method of development which repeats phases of design, implementation and testing is not adequate for systems like intelligent agents for which complex behavior is required but specification is unclear at the beginning of development process. Incremental design of agent's model during simulation seems more suitable for it enables direct feedback in behavioral changes of a system. This interactivity speeds up development process and helps to uncover parts of a space of all models to designer - thanks to new knowledge acquired during simulation. This thesis aims to provide comparison of suitability of two agent architectures and respective platforms in context of SmallDEVS modeling and simulation framework for this methodology of development. First approach is reactive and decentralized subsumption architecture based on DEVS formalism and the second one is PNagent, framework realizing deliberative BDI architecture using Object Oriented Petri Nets.

The Hybrid Electric Vehicle Team of Virginia Tech (HEVT) is participating in the 2012-2014 EcoCAR 2: Plugging in to the Future Advanced Vehicle Technology Competition series organized by Argonne National Lab (ANL), and sponsored by General Motors Corporation (GM) and the U.S. Department of Energy (DOE). The goals of the competition are to reduce well-to-wheel (WTW) petroleum energy consumption (PEU), WTW greenhouse gas (GHG) and criteria emissions while maintaining vehicle performance, consumer acceptability and safety. Following the EcoCAR 2 Vehicle Development Process (VDP) of designing, building, and refining an advanced technology vehicle over the course of the three year competition using a 2013 Chevrolet Malibu donated by GM as a base vehicle, the selected powertrain is a Series-Parallel Plug-In Hybrid Electric Vehicle (PHEV) with P2 (between engine and transmission) and P4 (rear axle) motors, a lithium-ion battery pack, an internal combustion engine, and an automatic transmission. Development of a charge sustaining control strategy for this vehicle involves coordination of controls for each of the main powertrain components through a distributed control strategy. This distributed control strategy includes component controllers for each individual component and a single supervisory controller responsible for interpreting driver demand and determining component commands to meet the driver demand safely and efficiently. For example, the algorithm accounts for a variety of system operating points and will penalize or reward certain operating points for other conditions. These conditions include but are not limited to rewards for discharging the battery when the state of charge (SOC) is above the target value or penalties for operating points with excessive emissions. Development of diagnostics and remedial actions is an important part of controlling the powertrain safely. In order to validate the control strategy prior to in-vehicle operation, simulations are run against a plant model of the vehicle systems. This plant model can be run in both controller Software- and controller Hardware-In-the-Loop (SIL and HIL) simulations. This paper details the development of the controls for diagnostics, major selection algorithms, and execution of commands and its integration into the Series-Parallel PHEV through the supervisory controller. This paper also covers the plant model development and testing of the control algorithms using controller SIL and HIL methods. This paper details reasons for any changes to the control system, and describes improvements or tradeoffs that had to be made to the control system architecture for the vehicle to run reliably and meet its target specifications. Test results illustrate how changes to the plant model and control code properly affect operation of the control system in the actual vehicle. The VT Malibu is operational and projected to perform well at the final competition. / Master of Science

[pt] A avaliação de uma interface de usuário pode ser feita em diferentes fases do ciclo de desenvolvimento de um software. Avaliações formativas são aquelas feitas ao longo do processo de design, antes do sistema estar concluído, e muitas vezes, antes de uma única linha de código estar escrita. No âmbito da engenharia semiótica, a linguagem de modelagem MoLIC (Modeling Language for Interaction as Conversation) visa apoiar a reflexão do designer durante o design de IHC. No entanto, não há um método específico para avaliar soluções de interação elaboradas com a MoLIC. Visando apoiar o processo de avaliação de uma solução representada em MoLIC, este trabalho apresenta a MoLIC WOz, uma ferramenta computacional que permite emular a interação usuário-sistema representada em um diagrama de interação MoLIC. A ferramenta torna possível essa interação através da técnica Wizard of Oz (WOz), onde um usuário interage com o sistema sendo operado por uma outra pessoa (o Wizard). O objetivo desse trabalho foi verificar de que maneira a MoLIC WOz promove reflexão ao seu usuário, aquele que interage com a emulação da interação do sistema em avaliação. Para avaliar essa proposta, foi realizado um estudo com doze participantes interagindo com a ferramenta. Os resultados do estudo indicam que a MoLIC WOz tem potencial para ajudar na avaliação da comunicabilidade de diagramas de interação por promover e motivar reflexão. Novos estudos com a ferramenta são sugeridos para verificar outras formas de apoio à avaliação formativa desse modelo. / [en] A user interface can be evaluated at different stages of the software development cycle. Formative evaluations are those that are made throughout the design process, before the system is finished, and often before a single line of code is written. Within semiotic engineering, the modeling language MoLIC (Modeling Language for Interaction as Conversation) aims to support the reflection of the designer during the HCI design. However, there is no specific method to evaluate interaction solutions prepared with MoLIC. Aiming to support the evaluation process of a solution represented in MoLIC, this work presents MoLIC WOz, a computational tool that emulates the user-system interaction represented in a MoLIC interaction diagram. The tool makes this interaction through the Wizard of Oz (WOz) technique, where a user interacts with the system being operated by another person (the Wizard). The goal of this work was to analyze how MoLIC WOz promotes reflection to its user, who plays the role of experiencing the emulation of system’s interaction. To assess this proposal, we conducted a study with twelve participants interacting with the tool. The results of this study indicate that MoLIC WOz has potential to support the communicability evaluation of MoLIC interaction diagrams through induced reflection. Further studies with the tool are suggested to verify other ways that support formative evaluations of this model.

Táto diplomová práca sa zaoberá implementáciou bezpečnostnej funkcie pre elektrický aktuátor, ktorá spočíva v riadení BLDC motora, po výpadku napájacieho napätia, keď je aktuátor poháňaný vstavanou pružinou.. Celé riadenie motora je navrhnuté v prostredí Matlab-Simulink technikou nazývanou návrh systému z modelu. Následne pomocou automatického generovania kódu bol získaný zdrojový kód, ktorý bol použitý v reálnom aktuátore a odtestovaný v reálnych podmienkach. Cieľom týchto testov bolo overiť reálnu možnosť nasadenia vyvinutých algoritmov v reálnych, komerčne dostupných produktoch.

Dans la continuité des travaux de recherches sur les systèmes de transmission mécanique embarqués, l’objectif de cette thèse est double : approfondir les modèles d’estimations des pièces d’un Actionneur Electromécanique (EMA) et étendre la vision transversale de la conception préliminaire aux aspects dynamiques. En effet, cette recherche permet, lors de la conception préliminaire basée sur les modèles, d’adapter les choix d’architectures et de technologies vis-à-vis des performances statiques et dynamiques à atteindre. Les modèles développés à partir des lois d’échelles sont étendus et exploités afin de modéliser les pièces élémentaires de l’EMA et de faire ressortir les règles de « bonnes pratiques » en conception préliminaire. On s’intéresse en particulier au dimensionnement des EMAs dans le domaine aéronautique. Dans un premier temps, nous avons donc créé des modèles d’estimation et des métamodèles des pièces de l’EMA. A cet effet, il est décomposé en carter et pièces élémentaires qu’il intègre.Dans un second temps, nous avons établis des règles de bonne conception et des pistes de dimensionnement de l’actionneur asservi en position. Contrairement aux recherches antérieures, qui se centraient sur le dimensionnement en puissance, nous avons pris en compte la synthèse de la commande pour établir ces règles. A partir de modèles de simulations, nous qualifions et quantifions l’influence des défauts (inertie et saturations, élasticité/jeu, frottement) sur les performances limites de l’EMA. En effet, les structures de commande usuelles et le choix des éléments de contrôle-commande sont intimement liés aux performances dynamiques et à ces défauts. Enfin, afin de se doter de moyens d’essais pour identifier finement un modèle de frottement dans des conditions aéronautiques de température, un banc d'essai sur le réducteur Harmonic Drive a été conçu et mis en œuvre. Il permet également d’amorcer la validation des règles de bonne conception / In the continuity of work of research on embedded systems of mechanical transmission, this these has two objectives: to improve estimation models of Electromechanical Actuator (EMA) pieces and to extend the cross-cutting vision of preliminary design to the dynamic aspects. Indeed, in the preliminary design based on models, this research should allow to adapt the choice of architectures and technologies to static and dynamic performance to achieve. The models developed from the scaling laws will be extended and exploited to modelize elementary pieces of the EMA and to highlight rules of "good practices" in preliminary design. We focus in particular on the design of EMA in aeronautic field. In the first time, we developed estimations models and métamodèles of elementary components of EMA which was decomposed in housing and elementary pieces.In a second time, we established rules of good practices for actuator sizing in control position loop. Contrary to older researches, we take into account control synthesis to create these rules. From simulations models, we quantified the influence of technological defects of components (inertia and saturations, elasticity (backlash), friction) on EMA performances. Indeed, the usual command structures and the choice of the elements of control are intimately linked to the dynamic performance and these defects.Finally, to give test way to identify with accuracy a friction model in aeronautical conditions of temperature, a test bench of Harmonic Drive was create, integrated and implemented. It allows booting the validation of rules of good practices in preliminary design.

Submitted by Alison Vanceto (alison-vanceto@hotmail.com) on 2017-04-19T14:31:07Z No. of bitstreams: 1 TeseACMO.pdf: 3842026 bytes, checksum: 7081c677ee2f15ff2fd1eb1c4a5281da (MD5) / Approved for entry into archive by Ronildo Prado (ronisp@ufscar.br) on 2017-04-27T14:02:11Z (GMT) No. of bitstreams: 1 TeseACMO.pdf: 3842026 bytes, checksum: 7081c677ee2f15ff2fd1eb1c4a5281da (MD5) / Approved for entry into archive by Ronildo Prado (ronisp@ufscar.br) on 2017-04-27T14:02:30Z (GMT) No. of bitstreams: 1 TeseACMO.pdf: 3842026 bytes, checksum: 7081c677ee2f15ff2fd1eb1c4a5281da (MD5) / Made available in DSpace on 2017-04-27T18:11:36Z (GMT). No. of bitstreams: 1 TeseACMO.pdf: 3842026 bytes, checksum: 7081c677ee2f15ff2fd1eb1c4a5281da (MD5) Previous issue date: 2016-12-13 / Não recebi financiamento / Situation Awareness (SAW) is a cognitive process defined as the perception of elements and events within a time frame, the understanding of their situation and the projection of their status. SAW is a prerequisite for decision-making in dynamic and complex systems and errors in SAW are an acknowledged source of human errors and accidents. Its study is pivotal in many industries, such as aviation, military, oil, gas and rails, and it is being increasingly considered for maintenance, since this activity is deemed critical for every industry. New technologies to support maintenance, such as E-Maintenance, will provide easier access to the desired information to technicians, but the way new technologies lead to improved SAW is influenced by how information is presented in the User Interface (UI), and many UIs for maintenance technicians support their decision-making regarding procedural and technical criteria, but not economical, legal, ethical and political. Therefore, they only allow a partial development of the user SAW, but not the complete comprehension and projection of a situation. These UIs ignore information requirements such as: risks and conditions of the environment; automations; actions and decisions of team members; rules, regulations and policies of enterprises. Therefore, the design and development of UIs to improve SAW in maintenance is compromised by the few solutions in the state of the art for SAW supportive UI design, for model-based design process and for frameworks and reference architectures. Cognizant to this gap, this thesis proposes a solution for the design and development of Situation Awareness support User Interfaces (SASUI) for maintenance work. For that three contributions are proposed: a conceptual framework of Situation Awareness Aspects (FSA) that assists developers in structuring heterogeneous sources of data into a knowledge representation model, to obtain a state oriented view of SAW; a multiagent architecture that instantiates and controls UIs to improve their support of SAW, by using a blend of SAW and UI agents to express the situation (and its projection) of real world entities in the UI; a methodology to create Model-based SAW User Interfaces (MBSAW-UI), in which designers model agents that will assist users in acquiring the SAW necessary for their decision-making process. These contributions follow a Cognitive Engineering approach to guide software developers in the UI design process and also empower domain experts to model their UIs, enabling an End-User Development (EUD) paradigm that facilitate future updates to the system. A study case of a maintenance activity was developed to evaluate these solutions, with two interfaces: a UI designed using MBSAW-UI; a UI designed using solely a Hierarchical Task Analysis. An experiment was performed and showed a 78% increase in SAW with the UI designed to support SAW, which lead to enhanced efficacy (3,85x less errors) and safety (3,87x less errors regarding unsafe behavior). / Consciência Situacional (SAW) é um processo cognitivo definido como a percepção de elementos e eventos em um volume de tempo e espaço, o entendimento da situação atual e a projeção do seu estado futuro. SAW é um pré-requisito para a tomada de decisão em sistemas complexos e dinâmicos, e os problemas em SAW são uma fonte reconhecida de erros humanos e acidentes. O estudo de SAW não só é fundamental em muitos setores (como, por exemplo, aviação, forças armadas, óleo, gás e ferrovias), como vem sendo considerado, de forma crescente, em áreas como a manutenção, que é uma atividade crítica para todas as indústrias. Novas tecnologias para apoio a manutenção, como a E-Manutenção, vão prover melhor acesso a informações desejadas, porém a SAW de um trabalhador que lida com tecnologia está correlacionada a Interface do Usuário (IU) do sistema, e diversas IUs para manutenção apoiam a tomada de decisão considerando critérios procedurais e técnicos, mas não econômicos, legais, éticos e políticos. Portanto elas somente apoiam um desenvolvimento parcial da SAW de seu usuário, mas não a completa compreensão e projeção da situação. Estas interfaces ignoram requisitos de informação como: riscos e condições do ambiente; automações; ações e decisões de colegas de equipe; regras, regulamentos e políticas das empresas. Dessa forma, o design e desenvolvimento de IUs para aprimorar a SAW na manutenção são comprometidos pelas poucas soluções no estado da arte de design de IU para apoio a SAW, de processos de design baseado em modelos e de frameworks e arquiteturas de referência. Ciente desta lacuna, esta tese propõe uma solução para design e desenvolvimento de Interfaces do Usuário que apoiam o estabelecimento de SAW (SASUI) em trabalhos de manutenção. Três contribuições foram geradas: um framework conceitual de aspectos de SAW (FSA) que auxilia desenvolvedores a estruturar fontes de dados heterogêneas em um modelo de representação do conhecimento, para obter uma visão de SAW orientada a estado; uma arquitetura multiagente que instancia e controla IUs para aprimorar o apoio a SAW, usando uma combinação de agentes de SAW e IU que expressam a situação (e projeção) de entidades do mundo real; e, finalmente, uma metodologia para criar IUs para SAW baseada em modelos (MBSAW-UI), na qual designers modelam agentes que irão auxiliar usuários a adquirir a SAW necessária para seu processo de tomada de decisão. Estas contribuições seguem uma abordagem de Engenharia Cognitiva para guiar desenvolvedores de software no processo de design de IU e para permitir especialistas de domínio a modelar suas IUs, habilitando um paradigma de End-User Development (EUD) que facilita futuras atualizações ao sistema. Foi desenvolvido um estudo de caso de uma atividade de manutenção para avaliar as soluções propostas, usando duas interfaces: uma projetada usando a metodologia MBSAWUI; e outra usando somente análise hierárquica de tarefas. Experimentos realizados mostram que as interfaces geradas com a metodologia proposta neste trabalho proporcionaram um aumento de 78% na SAW, o que levou a uma melhor eficácia (3,85x menos erros) e segurança (3,87x menos erros relacionados a comportamentos arriscados).

The dissertation thesis with the topic „Simulation Modelling of Electrical Drives for Selected Critical Applications“ focuses on the area of given applications in civil aviation. The selected application that the thesis deals with is an electrically driven and electronically controlled fuel pump supplying fuel to an aviation motor of the APU type. The thesis gives a comprehensive description of the design cycle of the unit and demonstrates implementing all the required critical functions. In the course of the design of the unit modern techniques in mathematical modelling, simulation, verification, monitoring and prediction of the operation status of airborne equipment were uses to the utmost extent. The purpose of these was to show the suitability of their application with regard to decreasing design time and cost, increasing lifetime and servicing intervals, as well as increasing user comfort and decreasing price. At the same time the required reliability was to be kept. The thesis also aims to prove and verify the suitability of using electronically commutated dc motors in critical applications in civil aviation. To reach this goal, it is necessary to design a robust drive control which would meet the given reliability requirements.